Re: Search problem
| From: | Rory Browne | Date: | Sun, 22 May 2005 02:40:43 +0000 |
| Subject: | Re: Search problem | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-215710@lists.php.net to get a copy of this message | ||
On 5/21/05, virtualsoftware@gmail.com <virtualsoftware@gmail.com> wrote:
> Hi,
>
> I need to build up a search module for a shop. If I make a basic search (product title for
> example) it is ok.
>
> $query = "SELECT product_id FROM products WHERE title LIKE '%$title%'";
>
> But i need an advance search for more than one field (title, description, price, weight)
> The problem is that i don't know which field is filled in by the user (title, description,
> price or weight)
Without error checking, or security code(ie supplied code contains SQL
injection vulnerability):
$sql = "SELECT product_id FROM products WHERE ";
if($_GET['title']){
$sql_ext[] = "title like '%{$_GET['title']}%' ";
}
if($_GET['description']){
$sql_ext[] = "description like '%{$_GET['description']}%' ";
}
$sql .= implode(" OR ", $sql_ext );
> I mean, the user can fill in all fields, or only price field, or title and weight etc
>
> How can i do the search?
>
> Thanks
>
>